Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
02/11/2024, 17:02
General
-
Target
ed689f99d04c6cca8010aec6288493f319edb3d4846c82f43319cd5bb1b2f666.exe
-
Size
218KB
-
MD5
981fb6702036e36bfaae20bc333177ba
-
SHA1
2a9e340fbacaaa0bcbbd6568f47ff17977e66ad7
-
SHA256
ed689f99d04c6cca8010aec6288493f319edb3d4846c82f43319cd5bb1b2f666
-
SHA512
7660844cb389ed8c41e09301b6a267d256eda1a6117c4491f2d5ea8199972f85a4620de58f707bffc7372861968bab12422eae3cff0e544d7b2f2d8333db13c5
-
SSDEEP
6144:kEQBDdO1z7L/EIhZDE9oLfFWlMZT7+DGaMwIC:kEGDdQNHEwWlMxYG/wI
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ed689f99d04c6cca8010aec6288493f319edb3d4846c82f43319cd5bb1b2f666.exe"C:\Users\Admin\AppData\Local\Temp\ed689f99d04c6cca8010aec6288493f319edb3d4846c82f43319cd5bb1b2f666.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168B
MD5d57e3a550060f85d44a175139ea23021
SHA12c5cb3428a322c9709a34d04dd86fe7628f8f0a6
SHA25643edf068d34276e8ade4113d4d7207de19fc98a2ae1c07298e593edae2a8774c
SHA5120364fe6a010fce7a3f4a6344c84468c64b20fd131f3160fc649db78f1075ba52d8a1c4496e50dbe27c357e01ee52e94cdcda8f7927cba28d5f2f45b9da690063
-
Filesize
24KB
MD5714ae3c1d1e424c842ae957fe47062e9
SHA1fec65a61be07ad8c4fd27147d0b24b012d0cc3b6
SHA25657984bad0b60a2135484a0d8592d4d887d60b2602994b7665b6074a5c4dc3ed0
SHA5122095716a374977f574bf7ac3146c0b67e1a130b7117f3081d046e2da79773dd6ec3a09461d06ab15f2b43b1fb13a8a210a36cdff64a50596e14126a9473ec1da
-
Filesize
57KB
MD5c15f3ae86a1ea5eeb1f48fa1856115a2
SHA1e85b6eb6d52fa7e0f30ffa547689fcf6e26adfe5
SHA256c3e67cf0ada1fd0309abdfb1c443344d8450447315175bf35c83e6888ea0208a
SHA5128b0b4f7323ec03eb9408c8df7f1c7e168ac12b2a8aa6665595601039620e2f36b5e73bea072d03b326ed0d9ea869a7fcbc5e6640b9c753e43ab27f107b222fa5
-
Filesize
481B
MD50004d41dea7843a431254254215ba169
SHA19397ace9773c5a78e3a66ebf96aa8ddae2eae0ca
SHA256bb0c65cd4d2d69e5af99c4aaea9c81c037e605a6c4fea0ae06f641027209765a
SHA512eb1e7adfc015c5ee11968dc0ede1ec53ebf5ce9cd0ddb7859a31667452721358405e701317efc5b8e9f54ff8f9bdabac975f7ae014314b427a05b0ea427aac96
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
42KB
MD544ab0258441777ee1fbd6e4f651e990c
SHA1af246fd3c6817ea14a6ec7a4f0e93cbca23005d9
SHA2567c9baa17f507730d03655d457c7f258eef3ee7ff166cdeaab15de59483f07066
SHA5120ba1af8c992e3605c5e594a5df33152d41427b67fbec8b05f155ada5fdf048b6346e651e35888aedc6623187fa9cffa61dd8c827bc684a273367c545aa952fb9
-
Filesize
42KB
MD57c0c5445372504cec961c3cbe32df2d1
SHA15d1cbbe9f2290b347753432a4684201f0300bf99
SHA256e2356f08e269c5a98ef71d18e068cdc8577cf338fe7151ea97b95d088e55ea8a
SHA51228ca991b37181ca87149ba5f18c353a9e4ca29364058963c813d5dee918936fbbab5be554a6b53ed90c91eb6561596ac65af42145729b7d54902e06e9218be58
-
Filesize
218KB
MD593664bd35910270aba1c196bef7b5311
SHA1838d23574cad5713830b47e9ffe353191c8903c2
SHA256e2b1aa7c24941db1ea601f57e5f35c6ba4750f730daeb3f5b7faf5ba09bb2edb
SHA512fe9c46ccecdae2e27e574844188a5795e225b52fb59c130eeac5d722677cb7866b14b293e54d6e9d0a3e6a9b2a7925765aed513821e995cf3150b191f87fcaec
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.8MB
-
Filesize
672KB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
728KB